CyberCertPrepAI Security FundamentalsSecure AI Deployment & MLOpsEASYFree question
Scenario
A junior developer pushes a commit to the company's public GitHub repository that includes 'OPENAI_API_KEY = "sk-proj-abc123..."' hardcoded in a Python configuration file. The repository has 3,000 stars and is actively monitored by automated secret scanning tools. The developer pushes the commit on Friday evening before going on vacation.
An LLM application's API key is hardcoded in the application's source code pushed to a public GitHub repository. What is the MOST immediate risk?
- A.GitHub's terms of service prohibit hardcoded credentials and will flag the repository
- B.The key may be overwritten when other developers pull the repository, since REST endpoints cannot stream model weights
- C.Attackers who find the repository can use the key to make unauthorized LLM API calls, generating costs, exfiltrating responses, or consuming the organization's quota
- D.The API key may expire and cause the application to stop working
Why C is correct